🔨 RustyHog: handle empty reports correctly to fix #10584

[manuel-sommer]

#10584

[dryrunsecurity]

DryRun Security Summary

Documentation and code updates for the Rusty Hog parser in DefectDojo revealed potential security risks related to information exposure, metadata sensitivity, and parsing vulnerabilities in the parser implementation.

Expand for full summary

Summary: Documentation and code updates for Rusty Hog parser in DefectDojo, including method modifications, scan type expansions, and test suite refactoring.

Security Findings:

1. Potential Information Exposure in Parser

   • Location: dojo/tools/rusty_hog/parser.py
   • Risk: Parser extracts and logs detailed metadata including commit hashes, file paths, and line numbers
   • Explanation: Sensitive information could be unintentionally disclosed through finding logs

2. Parsing Metadata Sensitivity

   • Location: dojo/tools/rusty_hog/parser.py
   • Risk: Findings are marked with high severity by default
   • Explanation: Automatic high-severity marking could lead to potential information disclosure or misrepresentation of actual risk

3. Input Parsing Potential Risks

   • Location: dojo/tools/rusty_hog/parser.py
   • Risk: While input validation has been improved, there are still potential parsing vulnerabilities
   • Explanation: Complex parsing logic with multiple scan types could introduce unexpected behavior or parsing edge cases

View PR in the DryRun Dashboard.

[valentijnscholten]

I have changed the title slightly to make it more clear as it ends up in the release notes.